Hunting malware with Volatility v2.0

[Nytro]

Hunting malware with Volatility v2.0

Frank Boldewin

CAST Forum

December 2011

(English edition)

What is Volatility?

- Forensics framework to acquire digital artifacts from memory dumps

- Completely written in Python

- Current stable version is 2.0.1

- Easy to use plugin interface

- Supports the following x86 Windows versions

- Windows XP SP 2, 3

- Windows 2003 Server SP 0, 1, 2

- Windows Vista SP 0, 1, 2

- Windows 2008 Server SP 1, 2

- Windows 7 SP 0, 1

Download:

http://reconstructer.org/papers/Hunting%20malware%20with%20Volatility%20v2.0.pdf

Sursa: CAST Slides: Hunting malware with Volatility v2.0 | Offensive Computing